Skip to content

Java: Improve saneString in java/concatenated-command-line using controlledString + test exclusion #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mrigankpawagi wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Java: Improve saneString in java/concatenated-command-line using controlledString + test exclusion #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 9 additions & 10 deletions java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,20 +15,18 @@
import java
import semmle.code.java.security.CommandLineQuery
import semmle.code.java.security.ExternalProcess
import semmle.code.java.security.ControlledString
import semmle.code.java.dataflow.internal.ModelExclusions

/**
* Strings that are known to be sane by some simple local analysis. Such strings
* do not need to be escaped, because the programmer can predict what the string
* has in it.
* Strings that are known to be sane (controlled or compile-time constant).
* Such strings do not need to be escaped, because the programmer can predict
* what the string has in it.
*/
predicate saneString(Expr expr) {
expr instanceof StringLiteral
controlledString(expr)
or
expr instanceof NullLiteral
or
exists(Variable var | var.getAnAccess() = expr and exists(var.getAnAssignedValue()) |
forall(Expr other | var.getAnAssignedValue() = other | saneString(other))
)
expr instanceof CompileTimeConstantExpr
}

predicate builtFromUncontrolledConcat(Expr expr) {
Expand All @@ -48,5 +46,6 @@ predicate builtFromUncontrolledConcat(Expr expr) {
from StringArgumentToExec argument
where
builtFromUncontrolledConcat(argument) and
not execIsTainted(_, _, argument)
not execIsTainted(_, _, argument) and
not isInTestFile(argument.getFile())
select argument, "Command line is built with string concatenation."
4 changes: 4 additions & 0 deletions java/ql/src/change-notes/2026-06-15-exec-unescaped-consolidated.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The `java/concatenated-command-line` query now uses `controlledString` and `CompileTimeConstantExpr` instead of the previous `saneString` heuristic, reducing false positives for expressions that are known to be safe. Additionally, results in test files are now excluded.
Loading